New install-how do I know if files from old install are corrupt?

[sofasurfer]

We believe that we have been hacked. Who knows whats in this pc now. So I bought a new drive, installed 16.04 and now all is well. Question is, how can I know if files on my old drive are contaminated? I intend to disconnect the new drive, hook up the old one and move necessary files to a thumb drive and then put them on my new hard drive. I suspect, but do not know that the email was the culprit, if indeed I was corrupted. Only files nessessary to save are bookmarks, photos, audio files (mp3s) and documents (pdfs). Do these need to be scanned or what?

[TheFu]

All files, especially pdfs and images can be hacked. AV is less than 80% effective - often only 50%. I don't know of any AV which scans for Linux specific issues. They all look for Windows stuff. Basically, you are a good neighbor by scanning - though it doesn't help any Linux machines.

The best way I know to check for corruption is to compare files across different backup versions, over time. If a file hasn't been changed in the last 6 months, then none of the backups should be different during that period. If it is changed and you didn't change it, then it has been altered by some other method, perhaps by being hacked, right?

Versioned backups are the only way that I know to determine these things - plus they are useful for 1,000 other issues commonly seen in computing.

[mörgæs]

The risk for an infection in GNU/Linux files is small.

The important part is that you install all security updates as soon as they are available and that you always think before entering the root password.

[yancek]

Exactly why do you believe you have been hacked? If you posted some details on what was happening that led you to that conclusion someone might have a suggestion.